This vulnerability exists in the ruoyi-vue-pro product up to version 2026.08, in the File Upload component's FileController.java file. It allows remote attackers to perform cross-site scripting (XSS) attacks by manipulating an unknown function related to file upload handling. The vulnerability is exploitable remotely without privileges or user interaction, but requires user interaction (UI:P). The vendor was contacted but did not respond, and no patch or remediation information is available. The exploit has been publicly disclosed but is not known to be actively exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the affected web application. The impact is limited to the medium severity level as per the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying temporary mitigations such as input validation and output encoding on the affected component if possible. Monitor official channels for updates or patches from the vendor.